CVE-2026-32632

🗓️ 18 Mar 2026 17:47:25Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 68 Views🌐 WEB

Glances REST/WebUI accepts arbitrary Host headers enabling DNS rebinding until version 4.5.2.

Reporter	Title	Published	Views	Family All 29
attackerkb	CVE-2026-32632	18 Mar 202617:47	–	attackerkb
AlpineLinux	CVE-2026-32632	18 Mar 202617:47	–	alpinelinux
Information Security Automation	April Linux Patch Wednesday	22 Apr 202616:00	–	avleonov
BDU FSTEC	Glances Monitoring Tool Unauthorized Access	24 May 202600:00	–	bdu_fstec
Circl	CVE-2026-32632	14 Mar 202614:52	–	circl
CNNVD	Glances security vulnerabilities	18 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-32632 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding	18 Mar 202617:47	–	cvelist
Debian CVE	CVE-2026-32632	18 Mar 202617:47	–	debiancve
Github Security Blog	Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding	16 Mar 202616:34	–	github
Mend	CVE-2026-32632	18 Mar 202617:47	–	mend

NVD

Vulners

Node

nicolargo glancesRange<4.5.2

[
  {
    "vendor": "nicolargo",
    "product": "glances",
    "versions": [
      {
        "version": "< 4.5.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nicolargo/glances/releases/tag/v4.5.2
github	www.github.com/nicolargo/glances/commit/5850c564ee10804fdf884823b9c210eb954dd1f9
github	www.github.com/nicolargo/glances/security/advisories/GHSA-hhcg-r27j-fhv9

Parameter	Position	Path	Description	CWE
Host	header	/	The FastAPI application accepts arbitrary Host headers without allowlisting, making the REST API and WebUI vulnerable to DNS rebinding attacks.	CWE-346
Host	header	/token	The token endpoint is reachable through attacker-controlled domains in DNS rebinding scenarios due to lack of Host header validation.	CWE-346

17 Jun 2026 10:36Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.9

EPSS0.00188

SSVC

CWE-346